The Linux kernel GVE driver incorrectly indexes header buffers by queue position instead of the unique buffer identifier during both the post and read stages. This mis‑alignment allows the driver to read a header belonging to a different packet and to overwrite a buffer still in use by the hardware device, leading to corrupted packet headers, throughput degradation and possible kernel memory corruption. The weakness is a desynchronization flaw that can compromise data integrity and stability.

All Linux kernels that include the unpatched GVE driver containing the buggy gve_rx_post_buffers_dqo and gve_rx_dqo functions are affected. The advisory does not list specific kernel versions, so any build with the pre‑fix logic is at risk.

This vulnerability has a CVSS score of 9.8, an EPSS score of <1%, and is not listed in CISA KEV. Based on the description, the likely trigger is the interaction of hardware GRO and header‑split enabled on a GVE interface, which causes out‑of‑order completions. This inference is drawn from the bug’s reference to differing orders between posted buffers and completions. Exploitation would probably require network traffic that exercises the GVE interface under these conditions or a local privilege escalation that manipulates GVE traffic. The bug can lead to memory corruption in kernel space, suggesting a high potential impact if triggered. However, the precise exploitation difficulty is uncertain due to the lack of public exploitation data.